Who is covered?

The private sector provisions of the Privacy Act apply to organisations (including not-for-profits) with an annual turnover of more than $3 million. The provisions also apply to all health service providers regardless of turnover, government contractors, and some small businesses with an annual turnover of $3 million or less.

In addition, even if an organisation is covered by the Act, certain acts and practices of the organisation will be exempt. These are:

non business acts and practices;
acts and practices by an employer organisation which relate to a current or former employment relationship or employee records;
if the organisation is a contracted service provider for a Commonwealth contract (whether or not the organisation is a party to the contract) and the organisation would be a small business operator if it were not a contracted service provider, then any act done or practice engaged in otherwise for the purpose of meeting an obligation under a Commonwealth contract is exempt;
acts and practices of media organisations in the course of journalism — the phrase 'in the course of journalism' is not defined;
acts and practices of registered parties, political representatives (Commonwealth, State and local) and their contractors and volunteers.